Remote Application Security Engineer – Build Secure SaaS

Camunda; Boston (MA); Remote; USD 120,000 - 193,000; Full time

Benefits offered by this job

Remote & Flexible

Annual Kickoff trips

Health & Wellbeing

Retirement & Insurance

Learning stipend

Job summary

Camunda is hiring an Information Security Engineer with a focus on Application Security to join our Information Security team. We take security seriously but keep it practical, working with engineering to build secure software from the start and to enable safe AI-powered automation.

You will triage vulnerabilities, run threat modeling sessions, analyze code with AI-assisted tooling, and contribute to internal security automation.

Qualifications

• At least 3 years in security or software engineering with 2+ in AppSec.
• Experience at a SaaS/product company with CI/CD and cloud.
• Hands-on triage with Snyk/Trivy/Semgrep/CodeQL; explain CVSS context.
• Threat modeling/design reviews (STRIDE) on web apps/APIs.
• Can read Java and write scripts; contribute to codebase.
• Experience using AI coding agents in daily work.
• Explain risk to non-security teammates.

Responsibilities

• Vulnerability management: triage findings from SCA, container and code scanning; coordinate fixes with engineering.
• Threat modeling and security reviews with R&D for new features and architecture changes.
• Code analysis with LLMs: review code and reproduce issues with tooling.
• Build internal security tooling and contribute to CVE registry and automation.
• Help engineers do the secure thing by default; answer questions and review PRs.
• On-call and incident response: participate in rotation and investigations.
• Support audits and write security advisories for customers.

Skills

3+ years security

SaaS experience

Vulnerability triage

Threat modeling

Java reading

AI tooling in code

Clear communication

Tools

Snyk

Trivy

Semgrep

CodeQL

Job description

Camunda is hiring an Information Security Engineer with a focus on Application Security to join our Information Security team. We take security seriously but keep it practical, working with engineering to build secure software from the start and to enable safe AI-powered automation.

You will triage vulnerabilities, run threat modeling sessions, analyze code with AI-assisted tooling, and contribute to internal security automation.